Unscored CVE-2015-3249 EUVD-2015-3304GHSA-465p-v3ff-mc33

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bo…

Published Oct 30, 2017 · Updated Aug 6, 2024 · Assigned by redhat

Package: trafficserver Package: trafficserver Ecosystem: Debian Ecosystem: Ubuntu

Description

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	trafficserver	5.3.1-1	—

Ubuntu